Mailing-List: contact commits-help@harmony.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@harmony.apache.org
Message-ID: <1925421352.1246013467736.JavaMail.jira@brutus>
Date: Fri, 26 Jun 2009 03:51:07 -0700 (PDT)
From: "Tim Ellison (JIRA)" <jira@apache.org>
To: commits@harmony.apache.org
Subject: [jira] Updated: (HARMONY-6248) Wildcard subjectAltName dNSName
 entries throw IOException
In-Reply-To: <472801395.1245943927428.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/HARMONY-6248?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tim Ellison updated HARMONY-6248:
---------------------------------

    Attachment: harmony-6248.patch

Ian,

I assume that the wildcard value only makes sense at the left hand side, and we would not allow a simple '*' as the full dns, i.e. it should only be allowed as a "*." name prefix?

Please try this patch and see if it fixes the issue for you.

> Wildcard subjectAltName dNSName entries throw IOException
> ---------------------------------------------------------
>
>                 Key: HARMONY-6248
>                 URL: https://issues.apache.org/jira/browse/HARMONY-6248
>             Project: Harmony
>          Issue Type: Bug
>          Components: Classlib
>            Reporter: Ian Payton
>         Attachments: harmony-6248.patch
>
>
> Using the DRLCertFactory JCE provider, calling getSubjectAlternativeNames() on an X509Certificate throws IOException if the subjectAltName extension in the certificate contains a dNSName entry with a wildcard (such as "*.example.com").
> This is ultimately because GeneralName::checkDNS() does not allow wildcard entries.  RFC3280 and RFC1034 both discuss wildcards, although a strict reading of RFC3280 would *appear* not to allow for them in a subjectAltName dNSName.  However, RFC3280 explicitly allows for application-specific semantics of use of wildcards in subjectAltName.  As the Harmony code currently stands, it is not possible for an application to even retrieve the subjectAltName values if they contain a dNSName that does not strictly conform to the "preferred name syntax" in RFC1034.  So it is not possible for an application to make the decision on what semantics to apply to a wildcard value.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.